Licensees, exchanges, and other market participants should prepare to comply with the listing, disclosure, capital, and other requirements that the new law imposes.

On October 13, 2023, California Governor Gavin Newsom signed California State Assembly Bill 39, which establishes the Digital Financial Assets Law (DFAL). The new law, which goes into effect on July 1, 2025, makes California only the second state after New York to adopt comprehensive regulation of digital financial assets[1] and associated service providers.

The DFAL authorizes the California Department of Financial Protection and Innovation (DFPI) to administer its provisions and requirements, which apply to the digital asset business activity of a person or entity (Covered Persons) engaging in, or holding itself out as being able to engage in, activities with California residents relating to the exchange, transfer, storage or “administration” of a digital asset,[2] whether indirectly or through a vendor.

Issuing a digital asset does not in itself require licensure, unless such asset is redeemable for legal tender, bank credit, or another digital asset. Issuers of stablecoins would therefore need to be licensed unless they block California residents, but not issuers of utility tokens or creators of tokenized real-world assets. Instead, the DFAL puts the burden on exchanges to ensure that digital assets they list meet specific requirements, including those related to disclosure.

Creators of DeFi protocols also appear to not be included, although questions arise on whether providers of interfaces to such protocols would be covered. The DFAL contains an exclusion for persons that contribute “only connectivity software … to a protocol governing transfer of the digital representation of value.” While this could be interpreted to mean only non-custodial wallets that merely allow the user to connect to various protocols, it could also exclude interface providers that allow users to connect to such protocols.

Other various categories of actors are exempt from the DFAL, such as banks, trust companies, payment processors, registered broker-dealers, entities regulated by the Commodity Futures Trading Commission, and clearing agencies registered or exempted pursuant to federal securities laws. Also exempt are activities related to in-game tokens that cannot be exchanged for legal tender outside of the relevant game, cryptocurrency mining, and rewards points.

The DFAL also does not apply to persons or entities not receiving compensation for their digital asset activities or with annual business activity of $50,000 or less. However, “compensation” appears to be interpreted broadly and will include any direct or indirect compensation for activities not only covered by the DFAL but also for provision of any other digital asset products or services. So, for example, a custody service that is provided at no cost but also sells tokens to California residents may not be exempt.

Requirements for All Licensees

Capital and Reserve Requirements

The DFAL outlines capital requirements for all licensees and tasks the DFPI with determining exact requirements for a licensee on an individualized basis. All licensees must:

• maintain a surety bond or trust account in an amount and form to be determined by the DFPI for the protection of California residents with whom licensees engage in digital asset business activities;
• maintain sufficiently liquid capital in an amount and form as the DFPI determines is “sufficient to ensure the financial integrity of the licensee and its ongoing operations based on an assessment of the specific risks applicable to the licensee.”

Notably, in addition to these capital requirements, a licensee holding digital financial assets on behalf of California residents must at all times maintain a reserve of each type of digital asset equal to the aggregate entitlements of the holders of such digital assets. To the extent that a licensee has dollar-denominated liabilities to residents, such licensee must also always hold cash or sufficiently liquid securities with an aggregate market value at least equal to the aggregate US dollar value of all outstanding liabilities to customers.

The DFAL contains several provisions that seek to insulate customers’ digital assets from creditor claims in the event of a licensee’s bankruptcy. For example, the DFAL states that even if customer digital assets are commingled with other assets of the licensee, such digital assets are deemed to be held in trust for the benefit of customers, and are not part of the general bankruptcy estate. The DFAL also suggests that Covered Persons should use the California Commercial Code’s provisions on financial assets and treat themselves as securities intermediaries.

Besides maintaining a surety bond or trust account and reserve assets, a licensee must pay an annual license fee in the amount of its pro rata share of the cost that DFPI incurred in administering the DFAL.[3]

Customer Disclosures

The DFAL lays out various customer disclosures that a licensee must make before engaging in digital financial asset activity with a customer. A licensee must disclose to California customers:

• applicable fees, how they are calculated, and that the customer is entitled to a 14-day advance notice of any fee or other material change;
• whether and to what extent a product or service is covered by insurance (public or private);
• which transfers or exchanges and accompanying payments are irrevocable, and, if applicable, how a customer may revoke a transaction or stop its authorization;
• a licensee’s liability, a customer’s responsibility to notify the licensee, and any error resolution rights and related basis for recovery by the customer in the case of unauthorized, mistaken, or accidental transfers or exchanges;
• that the date and time of execution of a transfer or exchange may differ from the time of initiation by the customer and that the customer is entitled to a notification at initiation and confirmation at conclusion of a transaction;
• that no digital financial asset is recognized as legal tender in California or the US; and
• a list of instances in the preceding 12 months when a licensee’s service was unavailable to 10,000 or more customers due to a service outage and the cause of each such outage.

The DFAL requires additional disclosures to customers on a transaction-by-transaction basis, though licensees may send such transaction-based disclosures on a once-daily basis covering all transactions that a customer entered into on a given day.

Requirements for Exchanges

Listing Requirements

Any person or entity subject to the DFAL’s licensing requirements that “exchanges or holds itself out as being able to exchange a digital financial asset for a resident” (Covered Exchanges) must certify to the DFPI prior to listing any digital asset that it has:

• assessed whether such digital asset would be deemed a security by applicable regulators;
• provided full and fair written disclosure of all conflicts of interest relating to the Covered Exchange and the applicable digital asset;
• comprehensively assessed consumer protection risks relating to cybersecurity, malfeasance and theft, code or protocol defects, and market-related risks (such as price manipulation and fraud);
• established policies and procedures for ongoing reevaluation of the appropriateness of the continued listing or offering of digital assets on the Covered Exchange; and
• established policies and procedures for the delisting of digital assets from the Covered Exchange, including notification of delisting to affected customers and counterparties.

The DFPI could require a Covered Exchange to cease listing of a digital asset that it listed without first providing the appropriate certifications to the DFPI. The DFPI may also impose fines of up to $20,000 for each day of violation.

Best Execution Requirements

The DFAL further requires that Covered Exchanges comply with requirements similar to those imposed on broker-dealers under securities laws and regulations. Specifically, each Covered Exchange must:

• make every effort to fully and promptly execute customer requests for exchanges of digital assets;
• undertake reasonable diligence to ensure that the outcome of exchanges for California residents are as favorable as possible, including with respect to:
  • the character of the market for a digital asset (including price and volatility);
  • the size and type of a requested transaction;
  • the number of markets checked for any given transaction; and
  • the accessibility of appropriate pricing for such requested transaction; and

• Review its best execution policies at least once every six months.

A Covered Exchange may not involve third-party intermediaries between itself and the best market for execution of a given transaction, unless the Covered Exchange can show that it cannot, without such intermediary, ensure execution of an exchange on such market.

The DFAL provides a safe harbor for a Covered Exchange’s failure to achieve best execution for a given transaction if it has properly created, implemented, and monitored its best execution policies and procedures. However, the DFAL notes that repeated failures to achieve best execution indicate a Covered Exchange’s failure to properly create or implement such policies and procedures.

Requirements for Stablecoins

The DFAL further outlines requirements applicable to all Covered Persons seeking to exchange, transfer, or store stablecoins. The DFAL prohibits Covered Persons from such activities unless:

• the stablecoin issuer has applied for or obtained a license from the DFPI, or is a federal- or state-chartered bank or trust, and

• the issuer at all times holds eligible securities[4] with an aggregate market value equal to or more than the aggregate amount of all stablecoins issued or sold by such Covered Person.

These restrictions do not apply to stablecoins that the DFPI has determined would not compromise the interests of California residents who may use such stablecoins as a payment for goods and services or as a store of value.[5] In making such determinations, the DFPI will evaluate a stablecoin in light of the following factors:

• The legally enforceable rights provided by the stablecoin issuer, including with respect to redemptions
• The amount, nature, quality, and risks associated with the reserve assets underlying a stablecoin
• The representations that the stablecoin issuer made with respect to the uses, and risks of uses, of such stablecoin
• Any other factors that the DFPI deems material

DFAL and Other Regulations

While the DFAL and the New York BitLicense regime are similar, they differ in one important aspect: the DFAL does not purport to regulate issuers of digital assets that are not redeemable. Further, unlike the guidance from the New York State Department of Financial Services (DFS), the DFAL does not require publication of attestations by issuers that are Covered Persons as to the sufficiency of reserves underlying stablecoins in circulation. The list of approved reserve assets under the DFAL is also notably more inclusive than the list of permitted assets and investments that DFS offers.

That said, the DFAL and the BitLicense framework have significant overlap. Indeed, the DFAL offers various exceptions to its requirements and restrictions for digital assets approved for listing by DFS and Covered Persons licensed by DFS (in each case on or before January 1, 2023) under the BitLicense framework[6].

Prospective licensees may look to DFS regulations, rules, and guidance that the DFAL generally defers to as a “best practices” guide to ensuring compliance with the DFAL, especially with respect to matters addressed by DFS on which the DFAL remains silent.

Conclusion

In signing the bill into law, Governor Newsom noted that “ambiguity of certain terms and the scope of this bill will require further refinement in both the regulatory process and in statute to provide clarity to both consumers, regulators and businesses subject to this new licensure framework.” Through rulemaking and enforcement, the DFPI will hopefully further clarify the various requirements imposed on Covered Persons under the DFAL, as the DFPI identifies and addresses any perceived gaps in the DFAL relative to existing DFS guidance.

Market participants should therefore evaluate their path to compliance with the law as enacted, but should also expect further refinements from the DFPI in the coming 18 months.

Endnotes

[1] Defined as “a digital representation of value that is used as a medium of exchange, unit of account, or store of value, and that is not legal tender, whether or not denominated in legal tender, except as specified.”

[2] The term “administration” refers to the issuance of a digital asset that is redeemable — issuance of nonredeemable assets is not a regulated activity.

[3] The pro rata share is calculated based on the number of California residents served by a licensee relative to the number of California residents served by all licensees, of the cost that the DFPI incurred in administering the DFAL.

[4] Eligible securities that may permissibly comprise the reserve assets underlying a stablecoin are set forth in Section 2082(b) and (c) of the California Financial Code and include:

• cash and cash deposits in insured banks, savings, and loan associations or credit unions;
• debt issued or guaranteed by the US government or any state government, and other debt rated as eligible by an eligible securities rating service;
• bankers acceptances eligible for discount by a federal reserve bank and receivables owed by a bank and resulting from an automated clearinghouse, debit, or credit-funded transmission;
• commercial paper rated as eligible by an eligible securities rating service;
• certain shares of investment companies registered under the Investment Company Act of 1940;
• accounts due to any licensee from any agent in the US for receipt of money for money transmission by the agent, provided that the account is current and not past due or doubtful of collection;
• any other security that the commissioner declares eligible.

[5] The DFPI can revoke such determinations if the stablecoin activities, market conditions, or activities of the issuer diverge from those that the DFPI previously evaluated.

[6] 23 NYCRR Part 200.